Medium 6.8

Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in...

CVE-2026-115396 First seen on SecPulse 04:14

Affected packages

Ecosystem	Package	Affected	Fixed
NationalSecurityAgency	ghidra	≥ 10.3, < 12.2	12.2

Original description The description as published by the source.

Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit decompressed size or compression ratio. Attackers can persuade a user to import a crafted theme ZIP whose icon entries expand to fill the host filesystem, causing later writes to fail.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.5; CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4: Medium 6.8; CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Published: Oct 23, 2026
First seen on SecPulse: 04:14
GHSA: GHSA-fr5c-6rcj-3fw2
CWE: CWE-409

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Denial of Service

All

Cwe 409 Nationalsecurityagency Ghidra

Detection sources

NIST National Vulnerability Database04:17
GitHub Security Advisories (Global)06:32
CVE.org (CVE Program・cvelistV5)04:14